Improper Authorization in IBM API Connect Affects Sensitive Data Access
CVE-2026-17428

5MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-17428?

A security flaw in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could permit a remote authenticated user to access sensitive information. This vulnerability arises because values in the request URL are used for making authorization decisions without adequate verification. Consequently, this can lead to unauthorized access to information that should be restricted to specific users.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

API Connect 10.0.8.0 <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch
https://www.ibm.com/support/pages/node/7295637
vendor-advisorypatch

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.